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@ A process and apparatus for detecting the 
occurrence of an event threshold and perfomv 

* ing some type of action in response to the 
detection. The disclosed use of the invention is 
for managing communication connections in a 
network. An event counter, a sliding event 
threshold counter and a sliding interval counter 
are initialized to prescribed initial states at the 
start of counter management At the expiration 
of an interval specified by the contents of the 
sliding interval counter, the sliding interval 
counter is incremented by an offset time value, 
and the sliding event threshold counter is up- 
dated by the sum of an offset event value and 
the event counter. The event counter is incre- 
mented on each occurcence of an event to be 
counted. Each time the event counter exceeds a 
threshold established by the sliding threshold 
event counter, the sliding threshold event 
counter is incremented by the contents of the 
offset event value, and the sliding interval 
counter is updated to the sum of the offset time 
value and the present time. Thus, all values of 
interest are maintained by a combination of 
keeping an absolute count of the events, and by 
"sliding" the contents of two counters, one of 
which is used to measure successive time inter- 
vals and the other to set a new threshold for 
each successive interval based on the offset 
threshold and the absolute event count at the 
beginning of the interval. 
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The invention relates to event counting. In partic- 
ular, it relates to the accumulation of vent informa- 
tion, such as n twork errors or usage information, for 
managing networks and in a way that conforms to cer- 
tain standard network specifications, such as set forth 5 
by the OSI standards. 

Network management applications often need to 
know, for a given type of event on a given connection, 
a variety of network performance items including the 
total number of events that occur during the connec- 10 
tion, the number of times that the event occurrences 
reach some threshold value (threshold crossing), how 
often this is occurring, and other information. The in- 
vention has the ability to perform these and other 
functions in a novel manner that conforms with OSI 15 
standards. 

Event counting is well known in various arts. For 
example, in the telephone switching art, it has been a 
common practice for many years to accumulate "peg" 
counts, of the utilization of switching office resources 20 
as well as the number of trouble reports reported by 
the resources. Such peg counts are typically used to 
estimate the adequacy of the resources for handling 
call loads, especially during busy hour traffic. Event 
counting is also known in the computing art U.S. pa- 25 
tent 3,906,454 describes a computer monitoring sys- 
tem for detecting, filtering and storing both hardware 
and software events. The system is geared toward a 
debugging system, whereby system information can 
be gathered without interrupting the operation of the 30 
computer system, thereby avoiding a source of sys- 
tem distortion that can render test results less useful. 
Event and error counting is aiso common in the net- 
working art, for example to access the level of trans- 
mission quality of the various network connections 35 
between nodes and users. 

TypicaJ known techniques for networks include 
accumulation of total error counts during a connection 
and the measuring of the duration of the connection; 
counting until a threshold is reached, irrespective of ao 
how long it takes to reach the threshold and counting 
to a threshold, thereafter followed by variations on the 
thresholds and timing intervals intended to discover 
bursty, but transient conditions, and actual degraded 
connections that should be retired. 45 

In U.S. patent 4,080,589, the occurrence of an er- 
ror triggers a timer and begins a counting interval. 
Subsequent errors occurring during the interval are 
counted until a predetermined threshold is reached or 
the timing interval expires. If the threshold is reached so 
before expiration of the interval, an alarm is signaled 
and the timer is reset to begin a new interval. Each 
subsequent error resets the timer until a complete er- 
ror fre interval occurs. 

In U.S. patent 4,241,445, a tim base circuit 55 
measures recurrent int rvals T2; each T2 contains an 
intermediate int rval T1 . A first rror counter counts 
errors up to a thr shold during intervals equal at most 



to T2 and at a minimum to T1. A second error counter 
counts each thr shold crossing of the first counter. 
The s cond counter signals an alarm when it reaches 
a predetermined value. 

In U.S. patent 4,291,403, if an error count ex- 
ceeds a predetermined threshold during an establish- 
ed time period, an alarm is generated and a second 
threshold is established to measure subsequent error 
rates. 

U.S. patent 4,339,657 establishes a variable tim 
interval measured by a predetermined number of op- 
erations that occur. The arrangement counts errors 
occurring during the operations and also counts th 
number of times that the error count crosses a prede- 
termined threshold. 

U.S. patent 4,800,562 is said to provide a contin- 
uous indication of data quality in a data stream. A first 
counter counts periodic events in a data stream. A 
second counter counts errors in the data stream. 
When the first counter overflows, it recycles and also 
resets the second counter. When the second counter 
overflows, it recycles and resets the first count r. If 
the error rate is low in relation to the periodic ev nts, 
the first counter will prevent the second counter fr m 
overflowing. An overflow of the second counter indi- 
cates an excessive error condition. 

Other background art is described in U.S. patents 
4,363,123 and 4,291,403. 

While the known art is satisfactory in specific in- 
stances, the art does not provide sufficient flexibility 
for today's standards. Techniques are needed that 
enable the accumulation of information that can b 
manipulated to provide a variety of measurements, 
while at the same time being efficient and simple to 
implement 

The invention is a method and apparatus for de- 
tecting the occurrence of an event threshold and p r- 
forming some type of action in response to the detec- 
tion. Successive intervals of time are measured in any 
desired way. An indication is maintained of the total 
number of events that have occurred from the start of 
event monitoring. An event threshold comparison val- 
ue is established at the beginning of each interval. 
The established value is made relative to the total 
number of events that have occurred up to that point. 
In response to a prescribed stimulus, a comparison is 
made between the indication of the total number of 
events that have occurred to the event comparison 
threshold value to determine if the threshold has been 
reached during the present interval. The stimulus may 
be the occurrence of an event, the expiration of an in- 
terval, or other desired stimulus. 

In a preferred embodiment, an event counter, a 
sliding vent threshold count r and a sliding interval 
counter are initial iz dtopr scribed initial stat sat the 
start of counter ma nag m nt. At the expiration of an 
interval sp cified by the contents of the sliding int rval 
counter, th sliding interval counter is incremented by 
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an offset time value, and th sliding event threshold 
counter is updated by the sum of an offset event value 
and the event counter. The vent counter is incre- 
ment d on each occurrence of an event to be count- 
ed. Each time the event counter exceeds a threshold 
established by- the sliding threshold event counter, th 
sliding threshold event counter is incremented by the 
contents of the offset event value, and the sliding in- 
terval counter is updated to the sum of the offset time 
value and the present Lime. Thus, all values of inter- 
est are maintained by a combination of keeping an ab- 
solute count of the events, and by "sliding" the con- 
tents of two counters, one of which is used to measure 
successive time intervals and the other to set a new 
event threshold for each successive interval based on 
the offset and the absolute event count at the begin- 
ning of the interval. 

One application of the invention is in a communi- 
cations network to manage the communication con- 
nections between the network nodes and especially 
to detect degradation of a connection. Relevant infor- 
mation for managing the network is provided by each 
node periodically to a network management applica- 
tion program in the preferred embodiment 

Description of the drawing : 

Fig. 1 sets one illustrative environment for use of 
the invention. A simplified, illustrative network 
consists of two nodes and a network manage- 
ment system located somewhere in the network. 
Communication adapter cards at each node con- 
tain apparatus and/or software for accumulating 
event information on connections to which they 
are attached and communicating this information 
via their nodes to the network manager; 
Fig. 2 shows illustrative steps executed in each 
communication adapters in the preferred embodi- 
ment for periodically administering event coun- 
ters and interval counters by sliding both types of 
counters along by offsets, thereby allowing the 
accumulation of both relative and absolute values 
during a connection; 

Fig. 3 shows illustrative steps that are executed 
by a communications adapter in the preferred em- 
bodiment upon the occurrence of an event to be 
measured; and 

Fig. 4 shows, as an aid to understanding, one 
example of the occurrence of errors of a given 
type and the resulting effect of the errors on the 
sliding counters. 

Detailed description ; 

Fig. 1 shows an illustrate system environment in 
which the inv ntion might b used. Th system in- 
cludes two processing nodes 100-1 and 100-2. Each 
node has a microprocessor (or oth r type of data proc- 



essing elem nt) 102. Th data processing element 
might consist of a desktop computer, such as a PS/2 
(Trademark) computer manufactured by International 
Business Machines, a reduced instruction set com- 

5 puter(RISC), orothergen ral or special purpos type 
of computer. In any event, a node in this illustrativ 
system includes some means for the element 102 to 
communicate with other nodes. In this illustrativ em- 
bodiment, communication adapter cards 104 provide 

10 the communication interface between data proc ss- 
ing element 102 of a node and other nodes via con- 
nections such as 108. In addition, the nodes commu- 
nicate with a network management system or applica- 
tion 106 located somewhere in the network. 

15 The purpose of the network manager 106 is to 
collect event information about the various conn c- 
tions 108 in the network from the individual nodes and 
to use the information in any desired manner for th 
purpose of controlling and maintaining the network. 

20 Toward this end, the method to be described for col- 
lecting event information at each of the nodes in- 
cludes a mechanism for communicating information 
to the network manager 106. Typically, each node col- 
lects event information pertinent to its end of a con- 

25 nection. For example, each node may receive infor- 
mation from the other node. It is typically a node's re- 
sponsibility to collect error statistics regarding the in- 
formation it receives and to communicate the error 
statistics to the network manager 106. 

30 The illustrative embodiment of the method sh wn 
in Figs. 2 and 3 uses a number of variables to perf rm 
its functions. These variables are: 

TYPES_OF_EVENTS = the number of differ- 
ent types of events to be monitored; 

35 COUNT(I) = the number of times events of typ 

I have occurred since a connection in question was 
established; 

CC(I) = a threshold event comparison valu for 
this event type I; 

40 CF(I) = a predetermined offset value that is 

added to the contents of COUNT(I) to get the n xt 
threshold event comparison value; 

TIME = a counter that counts the number of 
units of time of granularity DELAY (seconds, minutes, 

45 etc.) that have passed since the connection was es- 
tablished; 

TC(I) the present time threshold comparison 
value for this type of event; this variable sets the per- 
iodic intervals for each event type; 
so TF(I) = the offset added to the contents of TIME 

to get the next time threshold comparison valu for 
TC(I); in the illustrative embodiment, this offset is pre- 
determined for each I; 

TS(I) = a switch that indicates whether or not 
55 th network manager 106 should b notifi d when this 
event's present m asurement interval xpires, i. ., 
wh n TIME reaches the pres nt value contain d in 
TC(I); 



3 



5 



BP 0 515 296 A1 



6 



ACTION(I) = A preestablished table that con- 
tains instructions as to what type of action to perform 
at the expiration of ach timing interval and at ach 
v nt threshold crossing for each event type I. 
Figs. 2 and 3 show illustrativ flowcharts of the 
steps that are performed in the communication adap- 
ters 104 of a system to carry out the invention. When 
a connection like 1 08 is first established in the system, 
the steps of Fig. 2 are executed beginning at the pro- 
gram entry point INITIALIZE to begin event collection 
for the connection. Step 200 initializes TIME to zero 
to mark the beginning of the connection. Step 201 per- 
forms other necessary initialization functions. For 
each such type of event I, step 201 initializes vari- 
ables COUNT, TC and CC to beginning states. Spe- 
cifically, for each l f COUNT is set to zero, TC is set 
equal to the interval offset TF and CC is set equal to 
CF. This means that the contents of TC that determi- 
nes the end of the first measuring interval is set equal 
to the predetermined offset in TF; the present event 
threshold is set equal to the offset value in CF. 

Step 202 initializes a loop based on the value of 
I. The remaining steps of Fig. 2, executed as part of 
the loop, determine when the present timing interval 
for each type of event expires and "slides" both the in- 
terval threshold TC and the event threshold CC for- 
ward by their respective offsets to establish a new in- 
terval and event threshold. These actions allow abso- 
lute values of interval and event counts to be main- 
tained, while at the same time allowing differential val- 
ues to be used for present measuring purposes. Spe- 
cifically, step 204 decrements I to establish the next 
event type for which the present interval is checked. 
Step 206 determines if all event types have been 
processed for the present loop. If ail event types have 
been processed, step 208 introduces a prescribed 
amount of delay in loop processing following which 
step 209 increments TIME by the DELAY amount; 
control then returns to step 202 to process the loop 
again. 

For each event type in the processing of one pass 
through the loop; step 210 determines if the value in 
TIME is less than the value in TC. If it is, the present 
timing interval for event I has not yet expired. In this 
case. Fig. 2 merely proceeds to the next event type at 
step 204. If the timing interval has expired for this 
event type I, step 212 determines from ACTION(I) 
what action should be performed and schedules the 
action. For example, the action may be to do nothing, 
or it may be to send a message to the network man- 
ager 106 containing information also described by 
ACTION(I) so that it may track the intervals. Next step 
214 performs the "sliding" operations described 
abov to establish param t rs for then xt interval, cc 
is set to CF plus COUNT. This slides the event thresh- 
old count forward by an appropriat amount to allow 
a comparison of COUNT and CC on th occurrenc 
of an event to detect an event threshold crossing dur- 



ing the next interval. The total absolute event count is 
still maintained in COUNT. TC is incremented by the 
valu of its offset TF to establish the absolut timeval- 
u for nding the next interval. 
5 The counters TC and CC can overflow, sine they 

are finite in size. Step 216 determines if an overflow 
occurred in either counter step 218 notifies th n t- 
work manager 106 of an overflow. This allows the net- 
work manager to be prepared for a shift in numb rs 

10 on the next event message that may be receiv d for 
this connection. Control then proceeds to INITIALIZE 
at the beginning of Fig. 2 to restart the counters. 
Otherwise, the loop beginning at step 204 is rep ated 
for the next event type. 

15 The steps of Fig. 3 are executed each time an 
event of type J occurs on the connection in question 
(J is a particular instance of the event types I). Step 
300 immediately increments COUNT for the event 
type. Step 302 tests the new value of COUNT against 

20 the present threshold contained in CC. If the threshold 
is not reached, i.e., COUNT is less than CC, the rou- 
tine of Fig. 3 exits to await the next event occurrence. 
On the other hand, step 304, if the threshold is 
reached, the ACTION table is indexed by J to deter- 

25 mine the type of action to be performed when th 
threshold is exceeded. Typically, this might b the 
generation of a message containing parameters of in- 
terest for this type of event and the transmission of the 
message via microprocessor 1 02 to the network man- 

30 ager106. A simple example of such parameters might 
be the event type J, the total number of such events 
since connection from COUNT, the time sine th 
connection was established and the number of events 
J that have occurred during the present interval. On 

35 the other hand, depending on other information s nt 
to the microprocessor, say at the expiration of each in- 
terval (Fig. 2), the microprocessor may be program- 
med to calculate some of the illustrative parameters 
just mentioned, and others. The particular details of 

40 parameter generation, etc are not relevant to or part 
of the invention being described. 

Following step 304, step 306 updates the CC and 
TC variables for the event type J. A new interval of 
time is begun by setting TC to the sum of TIME and 

45 the interval offset TF. The rtew event threshold in CC 
is set to the present contents of CC plus the event off- 
set CF, Step 308 tests for an overflow of either CC(J) 
or TC(J). If there is no overflow, the program exits. 
Otherwise, step 310 notifies the network man ag r 106 

so of the overflow so that it adjust itself accordingly; step 
312 then reinitializes the counters in the same way 
that step 201 does before the program exits. 

Fig. 4 shows one example of how the contents of 
variabl s and intervals vary in relation to an assumed 

55 set of event J occurrences. It is assumed for illustra- 
tion and for vent typ J that th intervals are meas- 
ured in seconds, that the interval offset in TF is s t to 
60 seconds and that the event threshold offset CF is 
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set to 5. At th b ginning of the interval identified as 
400, it is assum d that the total event count CC is 0, 
i.e., no vents J have yet occurr d on the conn ction. 
Therefore, COUNT quals 0 at 400 and the threshold 
count CC equals 5 (from step 214). It is further as- 
sumed that th connection has be n in existence for 
3 minutes at 400. The effects of the contents of DE- 
LAY are ignored for this example, since it doesn't ma- 
terially affect the principles of operation that are being 
illustrated. Therefore, TC is set to TIME + CF = 180 + 
60 = 240 seconds at the beginning of 400. During in- 
terval 400, two events J occur as shown at 406. 
COUNT becomes equal to 2 as a result of these 
events (step 300). However, the interval threshold of 
5 is not exceeded (step 302) because COUNT (2) is 
less than CC (5). At the beginning of the next interval 
402, COUNT still equals 2 (the total number of events 
J that have occurred). CC is set to 7 (step 214) , the 
contents of COUNT plus the event offset, 5. TC be- 
comes 300, its earlier value (240) plus the interval off- 
set 60 seconds. During interval 402, 1 more event J 
occurs at 408. COUNT becomes 3. The threshold in 
CC (now 7) is still not exceeded. At the beginning of 
interval 404, COUNT equals 3, CC is updated to 8 
(COUNT plus CF) and TC becomes 360 seconds. 
During interval 404, 5 events J are assumed to occur. 
On the fifth event at 410, COUNT becomes equal to 
8. This equals the present sliding event threshold in 
CC. Therefore, step 302 triggers a threshold crossing. 
Step 304 then takes the appropriate action to notify 
the network manager 106 of the appropriate informa- 
tion as described by ACTION. Step 306 updates CC 
and TC to begin a new interval in this preferred em- 
bodiment 



Claims 

1. In a communications network comprising a net- 
work management application program, a plural- 
ity of data processing nodes, each node further 
comprising at least one communications adapter 
interfacing the node to a connection to another 
node of the network, a method of detecting event 
thresholds executed by the communications 
adapter, said method characterized in that it com- 
prises the steps of : 

(a) measuring successive intervals of time, 

(b) maintaining an indication of the total num- 
ber of events of a prescribed type that have 
occurred on the connection, 

(c) establishing an event threshold compari- 
son value at the beginning of each interval rel- 
ative to the total number of ev nts that have 
occurred up to that point, 

(d) in response to a prescribed stimulus, com- 
paring th indication of th total number of 
events that have occurred to th v nt com- 



parison threshold value to d termine if the 
thr shold has been reach d during the inter- 
val, and 

(e) transmitting the event information to the 
5 network management application program. 

2. The method of claim 1 wherein the step of meas- 
uring successive intervals of time further compris- 
es : 

10 incrementing the contents of an interval 

timer by a prestribed amount at the expiration of 
each interval defined by the timer to define the ex- 
piration time of the next interval defined by the 
timer relative to real time. 

15 

3. The method of claims 1 or 2, wherein the step of 
maintaining an indication of the total number of 
events further comprises 

incrementing an event counter in respons 
20 to each occurrence of an event, and wherein th 
prescribed stimulus is the occurrence of an ev nt 

4. The method of claims 1, 2 or 3, wherein the st p 
of establishing an event threshold further com- 

25 prises 

setting a threshold counter to the sum of 
the total event count and a predetermined offs t 
value. 

30 5. The method of claims 1 to 4, further comprising 
the steps of : 

(f) activating an alert in the event a thresh Id 
has been reached during an interval, 

(g) updating the interval timer and the ev nt 
35 threshold comparison value when the ev nt 

threshold is reached, said interval timer fur- 
ther comprises a first counter and the step f 
establishing an event threshold comparison 
value for each successive interval furth r 
40 comprises incrementing a second counter. 

6. A method of managing event counters, compris- 
ing the steps of 

(a) incrementing the contents of an interval 
45 timer by a prescribed amount at the expiration 

of each interval defined by the timer to define 
the expiration time of the next interval defin d 
by the timer relative to real time, 

(b) establishing an event threshold compari- 
50 son value at the beginning of each interval rel- 
ative to the total number of events that have 
already occurred, 

(c) incrementing an event counter in response 
to th occurrence of an event, and 

55 (d) comparing th vent counter to the event 

comparison threshold valu to determine if the 
threshold has b n reached during a present 
interval. 
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A m thod of managing event counters, compris- 
ing th steps of 

initializing an event counter, a sliding 
event threshold counter and a sliding interval 
count r t prescrib d initial states at the start of 5 
counter management, 

at the expiration of an interval specified by 
the contents of the sliding interval counter, 

a) incrementing the sliding interval counter by 

an offset time value, and 10 

b) updating the sliding event threshold counter 
by the sum of an offset event value and the 
event counter, 

incrementing the event counter on 
each occurrence of an event to be counted, 15 
and each time the event counter exceeds a 
threshold established by the sliding threshold 
event counter, 

c) incrementing the sliding threshold event 

cou nter by the contents of the offset event val- 20 
ue, and 

d) updating the sliding interval counter to the 
sum of the offset time value and the present 
time. 

25 

For use in a communications network comprising 
a network management application program, a 
plurality of data processing nodes, each node fur- 
ther comprising at least one communications 
adapter interfacing the node to a connection to 30 
another node of the network and containing appa- 
ratus for detecting event thresholds, said appara- 
tus further comprising 

- means for measuring successive intervals of 
time, 35 

- means for maintaining an indication of the to- 
tal number of events of a prescribed type that 
have occurred on the connection, 

- means for establishing an event threshold 
comparison value at the beginning of each in- aq 
terval relative to the total number of events 

that have occurred up to that point, 

- means responsive to a prescribed stimulus 
for comparing the indication of the total num- 
ber of events that have occurred to the event 45 
comparison threshold value to determine if the 
threshold has been reached during the inter- 
val, and 

- means for transmitting the event information 

to the network management application pro- so 
gram. 

The apparatus of claim 8, wherein the measuring 
means furth rcompris s an interval timer, means 
for incrementing th contents of the int rval timer 55 
by a prescribed amount at the expiration of each 
interval d fined by the timer to define th expira- 
tion time of the n xt int rval defin d by the timer 



relative to real time. 

10. Th apparatus of claims 8 or 9, wherein the main- 
taining means further comprises an event coun- 
t r ( means for increm nting the event counter in 
response to each occurrence of an event, and 
wherein the prescribed stimulus is the occurrence 
of an event 

11. The apparatus of claims 8 to 10, wherein th es- 
tablishing means further comprises 

- a threshold counter, 

- means for setting the threshold count r to 
the sum of the event counter and a pred ter- 
mined offset value. 

12. The apparatus of claims 8 to 1 1, further compris- 
ing 

- means responsive to the comparing means 
for activating an alert in the event a threshold 
has been reached during an interval. 

- means for controlling the interval timer to be- 
gin a new interval and means for updating the 
event threshold comparison value when the 
event threshold is reached, and wherein the 
interval timer further comprises a first count r 
and the establishing means further compris s 
means for. incrementing a second counter. 

13. An apparatus for managing event counters, com- 
prising 

- means for incrementing the contents f an 
interval timer by a prescribed amount at the 
expiration of each interval defined by the timer 
to define the expiration time of the next inter- 
val defined by the timer relative to real tim , 

- means for establishing an event threshold 
comparison value at the beginning of each in- 
terval relative to the total number of events 
that have already occurred, 

- means for incrementing an event count r in 
response to the occurrence of an event, and 

- means for comparing the event counter to 
the event comparison threshold value to de- 
termine if the threshold has been reached dur- 
ing a present interval. 
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